Deep Freeze Enterprise User Guide

(1)

(2)

Last modified: June, 2015

(3)

|

3

|

5

Uninstalling Deep Freeze on the Workstation via the Console . . . 95

Silent Install or Uninstall . . . 96

Example Command Line. . . 96

Silent Install or Uninstall Using a Shortcut . . . 97

Network Install on Multiple computers . . . 97

Installing Over Existing Deep Freeze Versions . . . 97

Installing Using Imaging . . . 97

Target Install . . . 98

Check for Updates. . . 99

Managing Deep Freeze Computers . . . 101

Login Screen . . . 102

Launching Deep Freeze on touch screen devices . . . 102

Status Tab . . . 103

Status on Next Boot . . . 103

Clone . . . 103

License . . . 103

Password Tab . . . 104

Network Tab . . . 105

ThawSpace Tab. . . 106

Permanent Software Installations, Changes, or Removals . . . 107

Managing Anti-Virus . . . 109

Anti-Virus Overview. . . 110

Enable Anti-Virus on Enterprise Console . . . 111

Install Anti-Virus Client on the workstation. . . 113

Anti-Virus Configuration. . . 114

Creating Anti-Virus Configuration . . . 114

Applying Anti-Virus Configuration . . . 139

Editing Anti-Virus Configuration. . . 140

Deleting Anti-Virus Configuration. . . 140

Using Faronics Anti-Virus from the Enterprise Console . . . 141

Anti-Virus Commands . . . 141

Scheduling Anti-Virus Tasks . . . 148

Using Anti-Virus on the workstation . . . 149

Launching Anti-Virus on the Workstation . . . 149

Scanning the Workstation. . . 150

Scanning a File or a Folder via Right-Click . . . 152

View Scanning History . . . 152

View and take action on Quarantined Files . . . 153

Updating Anti-Virus Definitions on the Workstation . . . 154

Managing Anti-Virus on the Workstation via the System Tray . . . 155

Check for Anti-Virus Updates . . . 156

Update Faronics Anti-Virus . . . 157

Uninstall Anti-Virus Client from the Enterprise Console . . . 158

Disable Faronics Anti-Virus from the Enterprise Console. . . 159

Deep Freeze Command Line Control . . . 161

Deep Freeze Command Line Control (DFC.EXE) . . . 162

DFC Return Values. . . 162

(6)

Faronics Anti-Virus Command Line Syntax . . . 165

Appendix A Ports and Protocols . . . 167

Appendix B Network Examples . . . 169

Example 1 - Single Subnet . . . 170

Example 2 - Multiple Subnets One local service . . . 171

Example 3 - Multiple Ports, Console Accessed Remotely . . . 172

Example 4 - Multiple Subnets Multiple local services . . . 173

Appendix C Troubleshooting a Remote Console Connection . . . 175

No Clients In the Console . . . 175

Port is in Use Error When Starting the Console . . . 176

Appendix D Creating a Customized Deep Freeze Enterprise Console . . . 177

Appendix E Deep Freeze Action Files - RDC Example . . . 181

Deep Freeze Action Files . . . 181

Action File Example . . . 181

Deep Freeze Action File Structure . . . 182

(7)

|

7

Preface

This user guide explains how to install, configure and use Deep Freeze Enterprise.

Topics

(8)

Important Information

This section contains important information about your Faronics Product.

About Faronics

Faronics delivers market-leading solutions that help manage, simplify, and secure complex IT environments. Our products ensure 100% machine availability, and have dramatically impacted the day-to-day lives of thousands of information technology professionals. Fueled by a

market-centric focus, Faronics’ technology innovations benefit educational institutions, health care facilities, libraries, government organizations, and corporations.

Product Documentation

The following documents form the Deep Freeze Enterprise documentation set:

• Deep Freeze Enterprise User Guide — This is the document you are reading. This document guides you how to use the product.

(9)

Technical Support

|

9

Technical Support

Every effort has been made to design this software for ease of use and to be problem free. If problems are encountered, contact Technical Support.

Email: [email protected]

Phone: 800-943-6422 or +1-604-637-3333 Hours: 7:00am to 5:00pm (Pacific Time)

Contact Information

• Web: www.faronics.com • Email: [email protected] • Phone: 800-943-6422 or +1-604-637-3333 • Fax: 800-943-6488 or +1-604-637-8188 • Hours: 7:00am to 5:00pm (Pacific Time)

Address:

Faronics Technologies USA Inc. 100, W. San Fernando Street, Suite 465 San Jose, CA, 95113

USA

Faronics Corporation (Headquarters) 609 Granville Street, Suite 1400 Vancouver, BC V7Y 1G5

Canada

Faronics Corporation (Europe)

(10)

(11)

|

11

Introduction

Topics

Deep Freeze Overview System Requirements

(12)

Deep Freeze Overview

Faronics Deep Freeze helps eliminate computer damage and downtime by making computer configurations indestructible. Once Deep Freeze is installed on a computer, any changes made to the computer—regardless of whether they are accidental or malicious—are never permanent. Deep Freeze provides immediate immunity from many of the problems that plague computers today—inevitable configuration drift, accidental system misconfiguration, malicious software activity, and incidental system degradation.

Faronics Anti-Virus can now be managed using Deep Freeze Enterprise (a separate license is required for Faronics Anti-Virus). Faronics Anti-Virus provides protection from security threats without slowing down computers due to slow scan times and large footprints. Built with

next-generation technology, Faronics Anti-Virus gives you powerful anti-virus, anti-rootkit and anti-spyware software in-one. This protects you against today’s highly complex malware threats while providing seamless integration with Deep Freeze.

(13)

System Requirements

|

13

System Requirements

• Deep Freeze and Faronics Anti-Virus are supported on:

— XP, Vista, Windows 7, Windows 8.1, Server 2003, 2008, 2008 R2, 2012 and 2012 R2 — Windows Embedded 7 and 8

— Deep Freeze requires 10% of the hard drive to be left as free space — Both 32 and 64 bit versions of Windows are supported

— Windows XP (32 and 64-bit) must have Service Pack 2 or later installed

• Faronics recommends a minimum of 256 MB of system memory in the protected systems • The Deep Freeze Configuration Administrator and Enterprise Console are supported on:

— XP, Vista, Windows 7, Windows 8.1, Server 2003, 2008, 2008 R2, 2012, and 2012 R2 — 32 and 64 bit versions are supported

(14)

Deep Freeze Enterprise Files

Deep Freeze uses different colored icons to represent its components. Files identified by a red icon should generally only be installed on an administrative computer.

Icon Definition

Deep Freeze Enterprise Configuration Administrator and Enterprise Console installation file.

The Configuration Administrator application is used to create customized, pre-configured, computer installation program files and Workstation Seeds.

The Enterprise Console application is used to centrally deploy, monitor, manage, and maintain Deep Freeze installations.

A customized Deep Freeze workstation installation file is created in the Configuration Administrator and deployed to workstations within the enterprise. This file includes the Workstation Seed. If the Deep Freeze workstation installation file is installed, the Workstation Seed is not required to be installed separately.

(15)

|

15

Installing Deep Freeze

This chapter describes the installation process of Deep Freeze.

Topics

(16)

Installation Overview

Installing Deep Freeze Configuration Administrator and Enterprise Console

The Configuration Administrator is intended to be installed only on the computer used to administrate Deep Freeze. The Configuration Administrator is used to create customized Deep Freeze installation files and Workstation Seeds. The Deep Freeze Enterprise Console installs automatically with the Deep Freeze Configuration Administrator.

Complete the following steps to install the Configuration Administrator:

1. Double-click the file DFEnt.exe to begin the installation process. The following screen appears:

2. Click Next. Read and accept the license agreement. Click Next.

(17)

Installation Overview

|

17

3. Enter the License Key in the License Key field or select the Use Evaluation check box to install in Evaluation mode. Click Next.

4. Enter the License Key in the License Key field or select the Use Evaluation check box to install in Evaluation mode. Click Next.

(18)

6. Alternatively, click Activate Options. Three options are available:

• Select Activate Online to activate Deep Freeze License online. This option is same as step 4. Click Next after selecting this option. Deep Freeze is activated online on clicking Next. • Select Activate Offline. This option allows you to activate by phone or email. Click Next after

activating. The Activate Offline screen is displayed.

(19)

Installation Overview

|

19 7. If you selected Activate Offline, send the License Key and Installation ID to Faronics Activation

(20)

8. Once the installation process is completed, the Customization Code screen appears.

(21)

Customization Code

|

21

Customization Code

The Customization Code is a unique identifier that encrypts the Configuration Administrator, the Enterprise Console, the computer installation files, the One Time Password Generation System, and Deep Freeze Command Line Control. This code is not a password that can be used to access Deep Freeze.

The Customization Code ensures that unauthorized administrators are prevented from accessing or controlling a computer. Multiple Deep Freeze administrators controlling the same group of computers must use a matching Customization Code.

Re-Initializing the Customization Code

If another administrator wants to create installation files with the same Configuration Administrator using a different Customization Code, complete the following steps: 1. Run DFInit.exe.

2. This resets the existing Customization Code for the Configuration Administrator and Enterprise Console.

3. Enter a new Customization Code.

4. Click OK for the new Customization Code to become active.

Update Mode

Update Mode can be used to automatically create updated versions of existing files of Deep Freeze Enterprise by executing a special Update command. This command completes two tasks:

• Updates previous versions of the Deep Freeze Enterprise Console and the Deep Freeze Configuration Administrator. (Found in Faronics > Deep Freeze 7 Enterprise.)

• Updates any user created files stored in the Faronics > Deep Freeze 7 Enterprise > Install Programs folder.

The benefit of these updates is that a number of files can be updated to the latest version while retaining their configuration data (created with an older version of Deep Freeze Enterprise). The command automatically updates files created by an administrator (.exe, .rdx) that are present in the Faronics > Deep Freeze 7 Enterprise > Install Programs directory, including the following sub-directories:

• Workstation install files • Workstation Seed files

In the example below, the district office has received a new version of Deep Freeze Configuration Administrator and can automatically update any existing Deep Freeze Workstation Install files and Workstation Seeds at a remote location.

(22)

The update command does not require a password, but does require a Customization Code. Use the following command syntax:

\PathToFile\DFEnt.exe /update=”Customization Code” c:\dfupdate.log • PathToFile must be replaced with the actual path to the installation file (DFEnt.exe)

• DFEnt.exe must be the actual name of the installation file (it may differ if it was downloaded) • Customization Code must be in quotes if there is a space in it

• Customization Code must match the old installation files’ Customization Code The log file provides full details of exactly which files were updated.

The update process may take a few minutes to complete.

(23)

One Time Passwords

|

23

One Time Passwords

The One Time Passwords Generation System is used to generate temporary passwords for Deep Freeze that expire at midnight on the day they were generated.

One Time Passwords dialog can be accessed from

• Tools>One Time Passwords in the Enterprise Console. For more information refer to Using Deep Freeze Enterprise Console.

• File>One Time Passwords in the Configuration Administrator. For more information refer to

Using Deep Freeze Configuration Administrator.

A One Time Password (OTP) can be useful if, for example, a Deep Freeze password is forgotten or if a configuration file was created without any passwords defined. An OTP can also be used to provide access to a computer for an individual performing maintenance duties without requiring that individual to know the permanent Deep Freeze password.

To create an OTP, complete the following steps:

1. Select either Password valid for one use only or Password valid for multiple uses. All OTPs expire at midnight on the day they were created, regardless of type.

2. Enter the OTP Token from the computer that requires the OTP into the Token field. The OTP Token for the computer is located in the logon dialog, as shown below.

3. Click Generate.

(24)

(25)

|

25

Using Deep Freeze Configuration

Administrator

Topics

Accessing the Configuration Administrator Passwords Tab

Drives Tab

Workstation Tasks Tab Windows Update Tab Batch File Tab

Advanced Options Tab

(26)

Accessing the Configuration Administrator

Open the Configuration Administrator by selecting the following path from the Start menu: Start > All Programs > Faronics > Deep Freeze 7 Enterprise > Deep Freeze Administrator The Configuration Administrator provides various tabs to configure passwords, Frozen drives, Workstation Tasks, Windows Updates, Batch Files, and Advanced Options. Once the settings have been configured, a Workstation Install file can be created. The Workstation Install file can be installed on the computers that need to be protected by Deep Freeze. Deep Freeze Administrator can also be accessed from within the Deep Freeze Console.

Toolbar and Menus

Toolbar

The Toolbar is available at the top of every tab in the Configuration Administrator.

Icon Function

New Blanks out all existing configuration settings. Opens with default configuration settings.

Open Open any saved .rdx, Workstation Installation file or Workstation Seed file. Save Save a .rdx, Workstation Installation file or Workstation Seed file. File name and path is listed at the bottom of the Configuration Administrator in the status section.

Save As Save the configuration settings as a .rdx file. Help Access the Deep Freeze Help file.

Create Create Workstation Installation File creates a customized installer for installing on workstations. The workstations can then be managed from the Deep Freeze Enterprise Console.

(27)

Accessing the Configuration Administrator

|

27 File Menu

The File menu contains the same options as those available on the Toolbar, with the additions of the option to choose from the available languages and Password Protection.

Password Protection

Password Protection offers an additional layer of security for the administrator.

To password protect access to the Configuration Administrator, complete the following steps: 1. Open the File menu and select Password Protection.

2. Select the Protect with password check box. 3. Enter and confirm the password.

4. Click OK to set the password or Cancel to exit the dialog without setting a password.

(28)

Passwords Tab

Deep Freeze Enterprise allows the administrator to choose up to 15 fixed passwords.

To create a password, complete the following steps: 1. Select Enable on the appropriate row.

2. From the Type drop-down list, choose the preferred kind of password. The following options are available:

— Workstation: designated for use at the workstation when the Login Screen is launched. — Command Line: for use with Command Line Controls. The Command Line Control tool

(DFC.exe) does not function unless at least one Command Line password is defined. 3. Optional: For passwords, select the User Change check box to allow a user to change the

password at the computer. 4. Enter the password.

5. To set a password to become active and expire on specified dates, select the Timeout check box and use the drop-down calendars to specify an Activation date and Expiration date.

(29)

Drives Tab

|

29

Drives Tab

The Drives tab is used to select which drives are to be Frozen (protected by Deep Freeze) or Thawed (unprotected). You can also create a ThawSpace — a virtual partition hosted on a local Frozen or Thawed drive where data can be saved permanently without being deleted by Deep Freeze during a reboot.

Frozen Drives

By default, all drives are Frozen. To put a drive in a Thawed state, clear the check box of the preferred drive.

While only local drives (partitions or physical drives) can be Frozen, all drive letters are shown because the pre-configured installation file may be installed on many computers with various hardware and software setups.

Example

(30)

ThawSpace

ThawSpace is a virtual partition that can be used to store programs, save files, or make permanent changes. All files stored in the ThawSpace are retained after a restart, even if the computer is Frozen. A ThawSpace can be created on a drive that is configured to be Frozen or Thawed.

To create a single ThawSpace or multiple ThawSpaces using the Configuration Administrator, complete the following steps:

1. Select the Drive Letter. The default letter is T:. However, it can be changed to any available letter. The next available letter is automatically used if the selected drive letter already exists on a computer when Deep Freeze is installed.

— When a Drive Letter is selected from the drop-down and used to create a ThawSpace, it is removed from the drop-down.

— When a ThawSpace is removed, the corresponding Drive Letter is added back to the drop-down.

— The Drive Letter cannot be same as the Host Drive.

2. Enter the Size. This is the size of the ThawSpace. The maximum size is 1024 GB and the minimum size is 16MB.

— If the computer does not have enough free space to accommodate the selected ThawSpace size, the size of the ThawSpace is adjusted downward to ensure proper operation of the computer.

— If you select the Size less than 16MB, the ThawSpace is set to 16MB.

(31)

Drives Tab

|

31 3. Select the ThawSpace storage unit in MB or GB.

4. Select the Host Drive.

— The Host Drive is the drive where the ThawSpace is created.

— The storage required for the ThawSpace is used from the total storage available on the Host Drive.

5. Select Visible or Hidden from the Visibility drop-down.

— If you select Visible, the drive will be visible in Windows Explorer. — If you select Hidden, the drive will not be visible in Windows Explorer.

— However, the hidden drive can be accessed by typing the drive letter in Start>Run. 6. Click Add to add the ThawSpace.

Removing a ThawSpace

To remove a ThawSpace, select the ThawSpace and click Remove. The ThawSpace is removed and the drive letter is now added back to the Drive Letter drop-down. Click Remove All to remove all the ThawSpaces.

Example

In the above screen, a ThawSpace of 16 MB is created on the Host Drive C: and the ThawSpace is designated with the drive letter T:. The ThawSpace T: is set to Visible and can be accessed via the Windows Explorer.

Existing ThawSpace

The Retain existing Thawspace check box is selected by default to prevent ThawSpaces created during previous installations from being deleted.

A dialog is always displayed asking if the ThawSpace should be retained or deleted during an Attended Uninstall, regardless of whether Retain existing ThawSpace has been selected. This option is not displayed if the uninstall is performed through the Enterprise Console.

The Honor Group Policy settings for Hidden Drives ensures that the Group Policy settings for hidden drives do not conflict with the Deep Freeze settings for hidden drives.

Hidden drive settings for Group Policies are user-specific. Hidden drive settings for Deep Freeze are global if the Honor Group Policy settings for Hidden Drives option is disabled.

Before removing a ThawSpace, remove any profile redirections or Symbolic Links. Removing a ThawSpace will also remove the data stored in it.

A ThawSpace is not protected by Deep Freeze. Deploy standard data protection options such as, Anti-Virus and backup procedures.

It is recommended to assign Drive Letters towards the end of the alphabet (X, Y, Z) in order to avoid automatic reassignment when a removable drive is

(32)

Always Thaw External Hard Drives

The Always Thaw External Hard Drives pane has two check boxes, USB and IEEE 1394

(FireWire) and both check boxes are selected by default. This ensures that the USB or IEEE 1394 (FireWire) hard drives are always Thawed.

If the USB and/or IEEE 1394 (FireWire) external hard drives check boxes are cleared, the drive is Frozen or Thawed according to the letter each drive mounts to in the Frozen Drives section. Network drives and removable media drives (floppy, memory keys, CD-RW, etc.) are not affected by Deep Freeze and therefore cannot be Frozen.

Example

In the above screen, drives E: and F: are selected in the Frozen Drives pane.

Let us assume that E: corresponds to a USB hard drive and F: corresponds to an IEEE 1394 (FireWire) hard drive.

The USB and IEEE 1394 (FireWire) check boxes are selected in the Always Thaw External Hard Drives pane, the external hard drives would be Thawed.

(33)

(34)

Workstation Tasks Tab

The Workstation Tasks tab allows you to schedule various tasks that run at the workstation. The Workstation Tasks reside at the workstation and will run even if the workstations lose their network connectivity or if they are unable to communicate with the Deep Freeze Console. The Workstation Tasks are part of the Workstation Install File or Deep Freeze Configuration (.rdx) file. The following Workstation Tasks are available:

• Windows Update - schedule Windows updates. You can configure additional settings in the Windows Update tab.

• Restart - periodically restart workstations to bring them to the original configuration or erase unwanted data.

• Shutdown - shut down the workstations at a specified time every day to save power.

• Idle Time - shut down or restart the workstations if they are idle for a specified period of time. • Batch File - run a batch file on the target workstation. You can configure additional settings in

the Batch File tab.

(35)

Workstation Tasks Tab

|

35

Windows Update

Windows Update tasks are scheduled for downloading Windows Updates on the workstation. Windows Updates can be downloaded even when the workstation is in a Frozen state. A Windows Update task has a Start Time and an End Time. After downloading Windows Updates, the

workstation reboots in a Thawed state to apply.

Workstation Tasks vs. Scheduled Tasks: If communication between the

Enterprise Console and the target computer fails, the Workstation Tasks are still executed since they exist on the target computer.

Tasks scheduled through the Scheduled Tasks Wizard in the Deep Freeze Enterprise Console exist on the Enterprise Console and not on the target

computers. Therefore, a continuous connectivity between the Enterprise Console and the target computer is required for the Scheduled Tasks to be executed. For more information, refer to the Scheduling Deep Freeze Tasks section.

Overlapping tasks cannot be created in the Workstation Tasks tab. If a newly created task overlaps with an existing task, a message is displayed.

A message can be displayed to the user for a maximum of 5 minutes. There must be a gap of a minimum of 5 minutes between any two tasks.

A Workstation Task is triggered only when Deep Freeze is in a Frozen state.

Windows Updates can also be applied manually on the workstation by selecting the workstation and via the command Run Windows Update from the

(36)

The Windows Update task can be scheduled by completing the following steps: 1. Select Windows Update from the Task Type drop-down and click Add. 2. The following options are displayed:

• Name - Specify a name for the task.

(37)

|

37 • Start - Select the Start Time.

• End - Select the End Time. The minimum interval is 15 minutes. Alternatively, you can select When Windows Update completes. If the Windows Update Task is not completed in 6 hours, Deep Freeze will end the task gracefully.

• Allow user to cancel task- Select the check box if the user is allowed to cancel the task before it starts.

• Shutdown after task - Select the check box to shutdown the computer after the task.

• Disable Keyboard and Mouse - Select the check box to disable keyboard and mouse during the task.

• Show message - Select the check box to display a message on the computer Before and During the task. Specify the time interval in minutes and enter a brief message to be displayed before the task starts.

3. Click OK. You will be taken to the Windows Update Tab to configure additional settings if it has not been configured earlier.

Example

In the above screen, a Windows Update task has been created to perform Windows Updates at the computer daily at 12:00 AM and end when Windows Update completes. The task is configured to display a message to the user before Windows Update. The keyboard and mouse are disabled.

The message This computer will reboot in %d for Windows Update is displayed in the Message to be displayed before the task field. This message can be edited. Add the word minutes in the message after %d to include the word minutes as part of the message.

When scheduling the Windows Update task select the When Windows Update completes option or ensure that you allow a sufficient time frame to permit all required update activities. Review of Microsoft Security Bulletins from the Technet web site (http://technet.microsoft.com/en-us/security/bulletin) to consider the appropriate time frame based upon the Critical and Security updates being released.

If you are not using WSUS, Deep Freeze Windows Update process will only apply non user-intervention Critical and Security updates. If you are using WSUS, all WSUS approved updates will be applied.

Alternatively, to apply other available updates visit the Microsoft Update Catalog site (http://catalog.update.microsoft.com) to obtain KB downloads which can then be applied using a Deep Freeze Batch File Workstation Task. Batch File tasks can also be used to apply other third party software updates.

(38)

Restart

The Restart task can be scheduled by completing the following steps:

1. Select Restart from the Task Type drop-down and click Add. 2. The following options are displayed:

• Day - Select the day, or specify if the task will occur on Weekdays or Weekends. • Start - Select the Start Time.

(39)

|

39 • Show message - Select the check box to display a message on the computer before the task

starts. Specify the time interval in minutes and enter a brief message to be displayed before the task starts.

3. Click OK.

Example

In the above screen, a Workstation Task has been created to restart the computer daily at 12:00 AM. The task is configured to display a message to the user 1 minute before the Restart.

Shutdown

The Shutdown task can be scheduled by completing the following steps:

1. Select Shutdown from the Task Type drop-down and click Add. 2. The following options are displayed:

(40)

• Day - Select the day, or specify if the task will occur on Weekdays or Weekends. • Start- Select the Start Time.

• Allow user to cancel the task - Select the check box if the user is allowed to cancel the task before it starts.

• Show message - Select the check box to display a message on the computer before the task starts. Specify the time interval in minutes and enter a brief message to be displayed before the task occurs.

3. Click OK.

Example

In the above screen, a Shutdown task has been created to shutdown the computer daily at 12:00 AM. The task is configured to display a message to the user 1 minute before the Shutdown task.

Idle Time

The Idle Time task can be scheduled by completing the following steps:

(41)

|

41

1. Select Idle Time from the Task Type drop-down and click Add. 2. The following options are displayed:

• Restart or Shutdown - Select Restart or Shutdown and specify the idle time in minutes after which the task must take place.

• Show message - Select the check box to display a message. Specify the time interval in minutes and enter a brief message.

3. Click OK.

(42)

Deep Freeze Enterprise User Guide Example

In the above screen, the Idle Time task is set to Restart when the computer is idle for 1 minute. A message is displayed to the user for 1 minute after the idle time has elapsed. The computer will restart unless the user cancels the task in the message dialog displayed.

Batch File

Batch File tasks are scheduled for executing batch files on the workstation. A Batch File task has a Start Time and an End Time. During this period, the batch file is executed on the workstation. You must configure additional settings in the Batch File tab for the Batch File Task to work. You can configure to shutdown the workstation after the Batch File Task is completed. Workstations will reboot Frozen after the batch file has been executed.

(43)

|

43

• End - Select the End Time. The minimum interval is 15 minutes.

• Allow user to cancel the task - Select the check box if the user is allowed to cancel the task before it starts.

3. Click OK.

4. Go to Batch File Tab to configure additional settings.

Example

In the above screen, a Batch File task has been created to execute a Batch File at the computer daily at 12:00 AM and end at 12.15 AM. The task is configured to display a message to the user before the Batch File is executed. The keyboard and mouse are disabled.

(44)

Thawed Period

Thawed Period tasks are scheduled to reboot the workstation is in a Thawed state. A Thawed Period is useful for some applications that update automatically at regular intervals. A Thawed Period is also useful for administrators to schedule maintenance and make permanent changes to the computers. This may include installing new software, updating software, configuration changes, and other maintenance functions. A Thawed Period has a Start Time and an End Time.

(45)

|

45

• End - Select the End Time. The minimum interval is 15 minutes.

• Allow user to cancel task - Select the check box if the user is allowed to cancel the task before it starts.

3. Click OK.

Example

Anti-Virus programs require regular virus definition updates to protect the system. Virus definitions can be updated during a Thawed Period.

In the above screen, a Thawed Period task has been created daily between 12:00 AM and 12:15 AM. The user is not allowed to cancel the task before it starts. The computer will shut down after the maintenance period. The keyboard and mouse are disabled during the maintenance period. The task is configured to display a message to the user 5 minutes before the task starts. The following message will be displayed on the computer at 11:55 AM The computer will reboot in 5 minutes to enter into a Thawed Period.

(46)

To ensure that the virus definitions are applied permanently, schedule the virus definition update for your Anti-Virus program so that it starts after Deep Freeze successfully starts the Thawed Period task and ends before Deep Freeze ends the Thawed Period task. This ensures that the virus definitions downloaded and updated by the Anti-Virus program stay permanently on the system. Hence the system is fully protected by Anti-Virus and Deep Freeze.

Faronics Anti-Virus: Faronics Anti-Virus works with Deep Freeze and does not

require a Thawed Period task for updating virus definitions. Faronics Anti-Virus can update virus definitions even when the computers managed by Deep Freeze are in a Frozen state.

Other Anti-Virus Programs: All other Anti-Virus programs require

(47)

Windows Update Tab

|

47

Windows Update Tab

The Windows Update tab allows you to customize settings for Windows Update. When you first create a Windows Update Task, you will be given an option to modify the default settings in the Windows Update tab. Modifying the default settings is not mandatory. Windows Update will be performed even with the default settings. The settings in the Windows Update tab will apply to all Windows Update tasks.

The settings in the Windows Update tab can be customized as follows:

Allow Deep Freeze to choose how Windows updates are downloaded: —select this check box to allow Deep Freeze to choose how Windows updates are downloaded. The following options are available:

• Select the Windows Updates download options:

— Do not cache Windows updates — select this option to download Windows updates only during the Windows Update task.

— Cache Windows updates —select this option to download when the workstation is in a Frozen or Thawed state and install during the Windows Update Task. This option creates a 4 GB ThawSpace and the Windows Updates are stored in the ThawSpace to ensure that Windows Update files are persistent across multiple reboots.

(48)

• Always retrieve updates from:

— Microsoft Windows Update website —select this option to download updates directly from the Microsoft Windows Update web site.

— Windows Server Update Services (WSUS) — select this option to download from WSUS server. Specify the SUS/WSUS Server. Optionally, select Use WSUS Target and specify the target. Microsoft SUS client and SUS/WSUS server can be downloaded at:

http://www.microsoft.com/wsus.

A log file is created for each individual workstation and is stored locally on the workstation.

The default name for the Deep Freeze Windows Update Log file is DFWuLogfile.log and can be found at:

C:\Program Files\Faronics\Deep Freeze\Install C-[X]\DFWuLogfile.log (32-bit systems) and C:\Program Files (x86)\Faronics\Deep Freeze\Install

C-[X]\DFWuLogfile.log (64-bit systems).

• You cannot change the name or location of the log file. • The Deep Freeze Log file and the Windows Update log file (at

c:\windows\windowsupdate.log) are very useful for troubleshooting your Windows updates.

• X is an incremental value depending on how many times you have installed Deep Freeze on the workstation.

Contact Faronics Support for help troubleshooting the DFWuLogfile.log (at http://support.faronics.com).

Contact Microsoft Support for troubleshooting Windows Update Errors. (See http://support.microsoft.com/kb/906602)

Also see Microsoft KB 902093 How to read the Windows Update log file found at: http://support.microsoft.com/kb/902093/ or visit

(49)

Batch File Tab

|

49

Batch File Tab

The Batch File tab allows you to customize settings for the Batch File task. When you schedule a Batch File task from the Workstation Tasks tab, you must configure the settings in the Batch File tab.

Configure the following options: • Batch File Authentication

Select Microsoft Network and select if the account to be used is a System account or a Specified user account. If you select Specified user account, specify the Login ID, Password, and

Domain. For Novell Network, select Novell, specify the Login ID, Password, Tree, Context, and Server.

• Batch File Contents

Enter a custom batch file to run during the Batch File task. The same batch file applies to all Batch File tasks. The following options are available when running custom batch files: — To clear the current batch file, click Clear.

— To load an existing file, click Import and browse to the location of the file.

— To save the contents of the field, click Export and browse to the preferred save location. The default configuration using the Microsoft Network/System Account

(50)

The batch file can be any command or series of commands that the command processor can run. You can run custom scripts that require the use of a third-party scripting engine by calling the script from the batch file as if it was being run from the command line.

Batch Files allow you to use VB Scripts, PowerShell scripts, Ninite and other third party solutions. Contact your software vendor or refer to your third party solution user guide to know more about scripting solutions that include no user

(51)

Advanced Options Tab

|

51

Advanced Options Tab

The Advanced Options tab is used to configure the network settings used by the computers to communicate with the Console, configure various security options, and administer License Keys.

Network

Communication between the Deep Freeze Enterprise Console and computers with Deep Freeze installed can use two different modes: LAN Mode or LAN/WAN Mode.

• LAN: Select LAN to configure Deep Freeze to communicate within a Local Area Network (LAN). LAN mode is a self-configuring mode that requires only a port number. The default port is 7725. The port number can be changed if it is in conflict with other programs on the LAN. In LAN mode, the Deep Freeze target computer and the Enterprise Console find each other through UDP broadcasts. These broadcasts only occur when computer or the Enterprise Console is started, ensuring that there is little network traffic associated with target computer and Console communication.

• LAN/WAN: Select LAN/WAN to configure Deep Freeze to communicate in both a LAN and a WAN (wide area network). LAN/WAN can be used in either a LAN or WAN environment and over the Internet. This mode uses an IP address or the computer name, along with a port number, to allow communication between the Enterprise Console and the managed computers.

The following two methods are available to identify the Console: • specify the Console IP, which must be static

(52)

When the Enterprise Console is behind a firewall or a NAT (network address translation) router, the firewall or router must be configured to allow traffic to pass through to the Enterprise Console. Depending on the firewall or router, computers may need to be configured with the IP address of the firewall so that traffic can be forwarded.

For more information on configuring and using Deep Freeze in a specific network environment, refer to Appendix B or contact Technical Support.

If a port number other than the default of 7725 (registered to Deep Freeze) is used, care should be taken to ensure that there are no conflicts with applications already running on the network. Well-known ports (0–1023) should be avoided and any Registered Ports (1024–49151) should be checked for conflicts before deployment.

A complete listing of the ports assigned to various applications can be found on the Internet Assigned Numbers Authority web site at http://www.iana.org/assignments/port-numbers.

Advanced Options

• Disable Command Line options - This option is selected by default. Clearing this check box allows for further customization of the Deep Freeze installation program when using the Silent Install System. Selecting this option prevents the pre-existing configuration choices from being changed during installation.

• Enable Deep Freeze local policies - For enhanced security, Deep Freeze removes the following local privileges: debugging programs, modifying firmware, and changing the system time; clear this option to use existing privileges.

• Allow user to change the clock - Select this option to allow Frozen users to adjust the system clock. Enable this feature during Daylight Savings to allow Windows to update the time automatically each season.

• Manage Secure Channel Password — Secure Channel Password is a feature of all Windows operating systems and only applicable if the system is running in Windows Server Domain Environment. Secure Channel Password is used for secure communication between the server and workstations. The Secure Channel Password is automatically changed based on the operating system settings. While using Deep Freeze, the newly changed Secure Channel Password is lost on reboot. The Manage Secure Channel Password option avoids this situation. The Manage Secure Channel Password feature of Deep Freeze changes the value of

Deep Freeze automatically configures the required exceptions in the Windows Firewall. It is not required to configure the Windows Firewall manually.

(53)

Advanced Options Tab

|

53 the Group Policy Maximum machine account password age based on the Deep Freeze state (Frozen or Thawed).

— Select the Manage Secure Channel Password option if you want Deep Freeze to manage Secure Channel Password.

When the workstation is Frozen: The workstation will not change the Secure Channel Password. This ensures that the secure communication between the server and the workstation is always maintained.

When the workstation is Thawed: The workstation will change the Secure Channel Password and sync the password with the server.

— Do not select the Manage Secure Channel Password option if you do not want Deep Freeze to manage the Secure Channel Password.

When the workstation is Frozen: When the Secure Channel Password is changed and synced with the server, it resets to the old password on reboot.

When the workstation is Thawed: If the workstation is Thawed on the day the Secure Channel Password is changed, the new password takes affect and the workstation is synced with the server.

• Restart on Logoff - Select this check box to Restart the computer automatically when it is logged off. If this option is selected, the computer is restarted when a user logs off in a Frozen state.

• Protect Master Boot Record (MBR) - Select this check box if you want Deep Freeze to protect the Master Boot Record. If this option is selected, changes to the Master Boot Record are reversed on reboot when the computer is in a Frozen state.

• Delay Frozen reboot to complete Windows updates - Select this option to delay reboot into a Frozen state if configuration or installation for Windows updates are pending. If you select this option and perform Windows updates (through means other than Deep Freeze), rebooting into a Frozen State will ensure that all Windows updates installation and configuration are

completed before rebooting into a Frozen state.

The Manage Secure Channel Password feature of Deep Freeze always overrides the Group Policy Maximum machine account password age and Disable machine account password changes.

Set the following in the Group Policy for the Manage Secure Channel Password feature to work:

Domain Controller: Refuse machine account password changes to Not Defined

If you select Delay Frozen reboot to complete Windows updates and install Deep Freeze, the installer checks if all Windows updates are completed. If the Windows updates are not completed, Deep Freeze installation will not proceed. Complete Windows updates and try installing Deep Freeze again.

(54)

Deep Freeze Enterprise User Guide Example

On a Windows Domain Environment using Windows Server 2008 R2 that manages multiple workstations, Secure Channel Password is used for secure communication between the server and workstations.

In Deep Freeze Configuration Administrator, go to the Advanced Options tab and select Manage Secure Channel Password. Create the Workstation Install file and deploy it to the workstation. Set the following in the Group Policy for the Manage Secure Channel Password feature to work: Domain Controller: Refuse machine account password changes to Not Defined

Domain Member: Disable machine account password changes to Disabled

When the workstation is Frozen, the Secure Channel Password does not change. When the workstation is Thawed, the Secure Channel Password is changed at the workstation and synced with the server.

Stealth Mode

• Show Frozen icon in system tray - Select this option to display the icon to indicate that Deep Freeze is installed and the computer is Frozen.

• Show Thawed icon in system tray - Select this option to display the icon to indicate that Deep Freeze is installed but the computer is Thawed.

If the options to show a Deep Freeze icon in the System Tray are unchecked, the keyboard shortcut CTRL+ALT+SHIFT+F6 must be used to access the logon dialog.

License

• License Key - Click Edit and enter the License Key.

• License Key Type - The License Key type is displayed. This field displays if this is an Evaluation version or a full version.

• Expiry Date - The Expiry Date for Deep Freeze is displayed. The License Key can be updated in the following ways:

— Through the Workstation Install file - The License Key is updated in the Configuration Administrator and a Workstation Install file is created. The License Key is now part of the Workstation Install file.

— Through the Enterprise Console - The License Key can be updated directly on the Enterprise Console. When the License Key is updated in the Enterprise Console, it is automatically updated on all connected computers. For more information on updating directly through the Enterprise Console, refer to the Licensing section.

— Manually on each computer - The License Key can be updated manually on each computer. For more information, refer to the Status Tab section.

When downloading version updates for Deep Freeze Enterprise from

(55)

Creating Workstation Install Program and Workstation Seed

|

55

Creating Workstation Install Program and Workstation Seed

To create customized Deep Freeze installation program files with all of the options that were configured in the previous sections, click the Create button in the Configuration Administrator toolbar and select Create Workstation Install Program.

This file can then be used to install Deep Freeze on computers using: • Attended Install (install based on user input)

• Silent Install system — install that does not inform user of progress or provide messages during installation). For more information on the Silent Install command, refer to Silent Install or Uninstall, page 96.

• Target Install — Through the Deep Freeze Enterprise Console for workstations that already contain a Seed or previous version of Deep Freeze that has been created with the same Customization Code.

To create a Workstation Seed, click the Create button in the Configuration Administrator toolbar and select Create Workstation Seed. The Workstation Seed is a lightweight program that allows administrators to remotely install and control computers from the Enterprise Console. The Workstation Seed can be installed as part of a master image and then deployed via imaging software. All computers on the LAN with the Workstation Seed installed are displayed in the Enterprise Console. The default file name for this program is DFWksSeed.exe.

All files are saved to Deep Freeze Enterprise/Install Programs folder by default. A different location can be chosen and the file name can be changed if required. It is recommended that a naming convention is used if you are creating multiple customized installation files.

The default file name for this program is DFWks.exe. We recommend that you keep the default name, but in larger deployments you may want to suffix it with information related to it's configuration such as: DFwks_10gbThawSpace.exe or DFWks_NoMaintenance.exe or DFwks_Wed-5pmUpdates.exe to assist in organization and identification of the installer functions. The same

recommendation applies for Deep Freeze Configuration files (.rdx) as well.

DFwks.exe, DFwksseed.exe, and depfrz.rdx files can be created and deployed interchangeably to any Deep Freeze computer that uses the same Customization Code. The Deep Freeze Seed can be used as a template/place holder to ensure your basic elements such as passwords, Network Configuration or standardized workstation tasks are all consistent. The seed will not utilize any of the

(56)

(57)

|

57

Using Deep Freeze Enterprise Console

This chapter describes using the Deep Freeze Enterprise Console.

Topics

Deep Freeze Configuration Deep Freeze Enterprise Console View Columns

Status Based Selection

Managing Communication Between the Console and Workstations Remote Consoles

Connecting to a Remote Console

Managing Deep Freeze with the Console Licensing

Scheduling Deep Freeze Tasks

Assigning Computers to Scheduled Tasks Managing Network and Groups

History

Adding computers to a Group Configure Custom Actions Console Customizer

Deep Freeze Enterprise Console Shutdown Installing Deep Freeze on the Workstation

Uninstalling Deep Freeze on the Workstation via the Console Silent Install or Uninstall

(58)

Deep Freeze Configuration

Deep Freeze Configuration is a group of settings that defines the behavior of Deep Freeze on the workstation. Deep Freeze Configurations can be created and applied through the Deep Freeze Console.

Complete the following steps to create a Deep Freeze configuration: 1. Launch Deep Freeze Console.

2. Go to Network and Groups > Available Configurations > Deep Freeze. 3. Right-click and select Create New Configuraiton.

4. Select or specify the settings for each tab as described in Using Deep Freeze Configuration Administrator.

5. Click OK.

6. Specify the name of the configuration and click OK.

Applying Deep Freeze Configuration

Once a configuration is created, it can be applied to multiple workstations. Complete the following steps to apply the Deep Freeze configuration: 1. Go to Workstations pane.

2. Select one or more workstations.

3. Right-click and select Update Configuration > Deep Freeze > [Configuration Name]. The configuration is applied on the selected workstation(s).

If you change the Deep Freeze Configuration for Passwords, Workstation Tasks, or Restart on Logoff, and apply the configuration, the settings are applied on the fly. All other settings require a reboot for the settings to take effect. ThawSpace and Disable Command Line changes cannot be modified by applying

(59)

Deep Freeze Configuration

|

59

Editing Deep Freeze Configuration

Complete the following steps to edit the Deep Freeze configuration: 1. Go to Networks and Groups Pane in Enterprise Console.

2. Select Available Configurations > Deep Freeze > [Configuration Name]. 3. Right-click on the selected configuration and select Edit Selected Configuration. 4. Edit the settings as required.

5. Click OK.

Deleting Deep Freeze Configuration

Complete the following steps to delete the Deep Freeze configuration: 1. Go to Networks and Groups Pane in Enterprise Console.

2. Select Available Configurations > Deep Freeze > [Configuration Name].

3. Right-click on the selected configuration and select Delete Selected Configuration. 4. Click Ok.

Exporting Deep Freeze Configuration

Complete the following steps to export the Deep Freeze configuration: 1. Go to Networks and Groups Pane in Enterprise Console.

2. Select Available Configurations > Deep Freeze > [Configuration Name].

3. Right-click on the selected configuration and select Export As. There are three options: • Select Workstation Installer. Specify a name and click Save.

(60)

Deep Freeze Enterprise Console

The Deep Freeze Enterprise Console displays the status of all Frozen, Thawed, and Target computers on the network and allows the administrator to perform specific tasks on those computers. Detailed status information is available with selective or group reporting. The Enterprise Console allows administrators to remotely perform the following tasks: • Immediately Target Install computers

• Selectively Freeze, Thaw, or Thaw Lock one or more computers • Lock or Unlock selected computers

• Restart or shutdown computers • Stop scheduled maintenance

• Power on computers equipped with a Wake-on-LAN network card • Update Deep Freeze software

• Schedule tasks directly from the Console • Send messages to computers

• Import groups and containers from Active Directory • Generate One Time Passwords

• Schedule Actions

• Customize the Enterprise Console • Update the License Key

The Enterprise Console can only wake a computer from a powered-down state if the computer is properly configured to power on when a Wake-on-LAN packet is received.

Launching the Enterprise Console

The Enterprise Console is installed with the Deep Freeze Configuration Administrator. Open the Console by selecting the following path from the Start menu:

Start > All Programs > Faronics > Deep Freeze 7 Enterprise > Deep Freeze Console

Activating the Enterprise Console

As a security feature of Deep Freeze Enterprise the OTP feature prevents unauthorized Deep Freeze Enterprise Console use. When the DFConsole.exe file is copied to a new computer, the Console must be activated. When it is run for the first time on the new computer, a dialog displays with an OTP Token.

(61)

Deep Freeze Enterprise Console

|

61

Status Icons

The Enterprise Console displays the status of the computers on the local area network with the following icons beside or above the computer name, depending on the view selected:

Icon Definition

Target: Computers that have the Deep Freeze Workstation Seed installed but do not have Deep Freeze installed; Deep Freeze can only be remotely installed on computers with this icon

Computers with Deep Freeze installed in a Frozen state

Computers with Deep Freeze installed in a Thawed state

Computers with Deep Freeze installed in a Thawed Locked state

Computers that are currently powered down

Computers that are currently in Maintenance Mode

Computers whose communication with the Console has been interrupted

(62)

View Columns

Deep Freeze Enterprise Console provides the ability to specify the columns that are displayed in the Workstations pane. Complete the following steps to display the desired columns:

1. Go to View > Columns.

(63)

Status Based Selection

|

63

Status Based Selection

You can select the workstations based on the Deep Freeze status on the managed workstations. The status based selection can be done through the Select menu in the Deep Freeze Enterprise Console. The Select menu has the following options:

• Select All Frozen - selects the workstations in Frozen state. Workstations that are Frozen and Locked are also selected.

• Select All Thawed - selects the workstations in Thawed state. Workstations that are Thawed and Locked are also selected.

• Select All Target - selects all the target computers where Deep Freeze can be installed. • Select All - selects all workstations.

The following selection options are available from the Status pane as well:

• Frozen - selects the workstations in Frozen state. Workstations that are Frozen and Locked are also selected.

• Thawed - selects the workstations in Thawed state. Workstations that are Thawed and Locked are also selected.

• Target - selects all the target computers where Deep Freeze can be installed. • History - displays the history.

• Total - selects all workstations.

(64)

Managing Communication Between the Console and Workstations

There are two types of connections from Console to workstation and Console to Console: 1. Local connections — connections that can only be accessed by the Enterprise Console that

hosts those connections.

2. Remote control enabled connections — connections that can be accessed by the Console that hosts as well as other Consoles connected remotely.

A computer can lose communication with the Console for any of the following reasons: • The computer is powered off manually or is shut down without warning

• The network is experiencing heavy traffic or outages

• The computer’s network settings are changed to point to a new Console

In most cases, communication with the computer is re-established when the computer is powered on or when the conditions causing the communications breakdown are rectified. It may take several minutes for the computer to report back to the Console and re-establish communication. If communication cannot be re-established, contact Technical Support for troubleshooting steps.

Configuring the local service

The local service is a service that sets up and maintains connections to computers. Enabling the local service

By default the local service will be installed and enabled when the Console is first run. To enable the local service again if it has been disabled (and/or uninistalled)

1. Select Tools > Network Configuration.

2. Select the Enable local service check box to enable it.

(65)

Managing Communication Between the Console and Workstations

|

65

Disabling the local service

Clearing the Enable local service check box and clicking OK displays the option to either disable the local service or uninstall the local service.

Adding a local service Connection

1. To add local service connection, select Tools >Network Configuration.

2. To add a connection select Add and specify the port number (7725 in this case).

3. To enable the Console to be controlled remotely, select Allow Remote Control check box and specify a password.

(66)

Editing or Removing a local service Connection

Once a Local Service connection has been added to it can be edited or removed through the Tools > Network Configuration.

To edit a local service connection perform the following steps: 1. Ensure the Enable Local Service option is selected.

2. Select a port from the Local Service connections list and click Edit.

3. The edit dialog appears that allows for the port to be controlled remotely and password protected.

4. To remove a port from the Local Service, highlight the port and click Remove. This does not delete the entry from the Network and Groups pane in the Enterprise Console. It simply removes it from the Local Service connections list.

(67)

Remote Consoles

|

67

Remote Consoles

A Remote Console is a Console that hosts one or more connections that allow other Consoles to connect through. Existing connections must be edited to allow them to be accessed remotely.

Setting up Remote Control Enabled Connections

To allow a connection to be accessed remotely perform the following steps: 1. Open Tools > Network Configurations.

2. Select the Enable local service check box. 3. Select a port from the list and click Edit. 4. Ensure Allow Remote Control is selected. 5. Specify a password.

(68)

Connecting to a Remote Console

Once a Remote Console has been established by the hosting Console it can be accessed by other Consoles from a different machine.

1. Select the Connect to Remote Console icon in the side bar or by right-clicking on the network item. Upon selection the Connect to Remote Console dialog appears:

2. In the Connect to Remote Console dialog, specify the connection details such as Remote Console Name, Remote Console IP, Port number, and Password. This information is provided by the administrator of the host Console. Once entered, this information can be retrieved by right-clicking a port in the Network and Groups Pane and selecting Properties.